Currently it is only possible to perform an image pull for one of the proxied services implicitly, by not defining build and in that case the name of the service has to be the name of the image to pull which can be from tricky to outright forbidding.